The Themify Event Post plugin versions up to 1.2.7 contain a stored cross-site scripting vulnerability (CWE-79) due to improper input neutralization during web page generation. This allows an attacker with high privileges to inject malicious scripts that are stored and later executed in the context of other users. The vulnerability has a CVSS 3.1 score of 5.9, reflecting medium severity with impacts on confidentiality, integrity, and availability. No official fix or patch has been published yet, and no known exploitation has been observed.

Successful exploitation of this vulnerability could allow an attacker with high privileges to execute arbitrary scripts in the browsers of users viewing the affected pages, potentially leading to information disclosure, data manipulation, or denial of service. The impact is rated medium based on the CVSS score and requires user interaction and elevated privileges.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict high-privilege user access to the plugin and validate or sanitize input data where possible to reduce risk. Monitor Themify's official channels for updates and apply patches promptly once available.